Nav

Norton AntiVirus™
User’s Guide
Norton AntiVirus™ User’s Guide
The software described in this book is furnished under a license agreement and may
be used only in accordance with the terms of the agreement.
Copyright Notice
Copyright  1995-2000 Symantec Corporation. All Rights Reserved.
Documentation version 7.0
PN: 07-30-00428
NO WARRANTY. The technical documentation is being delivered to you AS-IS, and
Symantec Corporation makes no warranty as to its accuracy or use. Any use of the
technical documentation or the information contained therein is at the risk of the user.
Documentation may include technical or other inaccuracies or typographical errors.
Symantec reserves the right to make changes without prior notice.
No part of this publication may be copied without the express written permission of
Symantec Corporation, Peter Norton Group, 20330 Stevens Creek Boulevard,
Cupertino, CA 95014.
Trademarks
Symantec, the Symantec logo, Norton, Norton SystemWorks, Emergency Disk,
LiveUpdate, Norton AntiVirus, Norton Utilities, and Rescue Disk are trademarks of
Symantec Corporation.
Windows is a registered trademark of Microsoft Corporation. Iomega is a registered
trademark and Zip, Zip Rescue are trademarks of Iomega Corporation. AOL and
CompuServe are registered trademarks of America Online, Inc. Prodigy Internet is a
trademark of Prodigy. Pentium is a registered trademark of Intel Corporation. Other
product names mentioned in this manual may be trademarks of their respective
companies and are hereby acknowledged.
Printed in the United States of America.
10 9 8 7 6 5 4 3 2 1
SYMANTEC LICENSE AND WARRANTY
NOTICE: SYMANTEC LICENSES THE ENCLOSED SOFTWARE LIMITED WARRANTY:

TO YOU ONLY UPON THE CONDITION THAT YOU ACCEPT Symantec warrants that the media on which the Software is
ALL OF THE TERMS CONTAINED IN THIS LICENSE distributed will be free from defects for a period of sixty (60)
AGREEMENT. PLEASE READ THESE TERMS CAREFULLY. IF days from the date of delivery of the Software to you. Your
YOU DO NOT AGREE TO THESE TERMS, PLEASE PRESS THE sole remedy in the event of a breach of this warranty will be
“NO” BUTTON TO EXIT INSTALL AS SYMANTEC IS that Symantec will, at its option, replace any defective media
UNWILLING TO LICENSE THE SOFTWARE TO YOU, IN returned to Symantec within the warranty period or refund the
WHICH EVENT YOU SHOULD RETURN THE FULL PRODUCT money you paid for the Software. Symantec does not warrant
WITH PROOF OF PURCHASE TO THE DEALER FROM WHOM that the Software will meet your requirements or that
IT WAS ACQUIRED WITHIN SIXTY DAYS OF PURCHASE, operation of the Software will be uninterrupted or that the
AND YOUR MONEY WILL BE REFUNDED. Software will be error-free.
LICENSE AND WARRANTY: THE ABOVE WARRANTY IS EXCLUSIVE AND IN LIEU OF ALL
The software which accompanies this license (the “Software”) OTHER WARRANTIES, WHETHER EXPRESS OR IMPLIED,
is the property of Symantec or its licensors and is protected by INCLUDING THE IMPLIED WARRANTIES OF
copyright law. While Symantec continues to own the Software, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE
you will have certain rights to use the Software after your AND NONINFRINGEMENT. THIS WARRANTY GIVES YOU
acceptance of this license. Except as may be modified by a SPECIFIC LEGAL RIGHTS. YOU MAY HAVE OTHER RIGHTS,
license addendum which accompanies this license, your rights WHICH VARY FROM STATE TO STATE.
and obligations with respect to the use of this Software are as DISCLAIMER OF DAMAGES:
follows: REGARDLESS OF WHETHER ANY REMEDY SET FORTH
YOU MAY: HEREIN FAILS OF ITS ESSENTIAL PURPOSE, IN NO EVENT
(i) use only one copy of one version of the various versions of WILL SYMANTEC BE LIABLE TO YOU FOR ANY SPECIAL,
the Software contained on the enclosed media on a single CONSEQUENTIAL, INDIRECT OR SIMILAR DAMAGES,
computer, or if only one version is contained on the enclosed INCLUDING ANY LOST PROFITS OR LOST DATA ARISING
media use one copy of such version on a single computer; OUT OF THE USE OR INABILITY TO USE THE SOFTWARE
(ii) make one copy of the Software for archival purposes, or EVEN IF SYMANTEC HAS BEEN ADVISED OF THE
copy the software onto the hard disk of your computer and POSSIBILITY OF SUCH DAMAGES.
retain the original for archival purposes; SOME STATES DO NOT ALLOW THE LIMITATION OR
(iii) use the Software on a network, provided that you have a EXCLUSION OF LIABILITY FOR INCIDENTAL OR
licensed copy of the Software for each computer that can CONSEQUENTIAL DAMAGES SO THE ABOVE LIMITATION
access the Software over that network; OR EXCLUSION MAY NOT APPLY TO YOU.
(iv) after written notice to Symantec, transfer the Software on a IN NO CASE SHALL SYMANTEC'S LIABILITY EXCEED THE
permanent basis to another person or entity, provided that you PURCHASE PRICE FOR THE SOFTWARE. THE DISCLAIMERS
retain no copies of the Software and the transferee agrees to AND LIMITATIONS SET FORTH ABOVE WILL APPLY
the terms of this agreement; and(v) the primary user of the REGARDLESS OF WHETHER YOU ACCEPT THE SOFTWARE.
computer on which the Software is installed may also use the U.S. GOVERNMENT RESTRICTED RIGHTS:
Software on a single home computer if he or she returns the RESTRICTED RIGHTS LEGEND. Use, duplication, or disclosure
completed product registration card which accompanies the by the Government is subject to restrictions as set forth in
Software. subparagraph (c) (1) (ii) of the Rights in Technical Data and
YOU MAY NOT: Computer Software clause at DFARS 252.227-7013 or
(i) copy the documentation which accompanies the Software; subparagraphs (c) (1) and (2) of the Commercial Computer
(ii) sublicense, rent or lease any portion of the Software; Software-Restricted Rights clause at 48 CFR 52.227-19, as
(iii) reverse engineer, decompile, disassemble, modify, applicable, Symantec Corporation, 20330 Stevens Creek
translate, make any attempt to discover the source code of the Boulevard, Cupertino, CA 95014.
Software, or create derivative works from the Software; or GENERAL:
(iv) use a previous version or copy of the Software after you This Agreement will be governed by the laws of the State of
have received a disk replacement set or an upgraded version California. This Agreement may only be modified by a license
as a replacement of the prior version, unless you donate a addendum which accompanies this license or by a written
previous version of an upgraded version to a charity of your document which has been signed by both you and Symantec.
choice, and such charity agrees in writing that it will be the Should you have any questions concerning this Agreement, or
sole end user of the product, and that it will abide by the if you desire to contact Symantec for any reason, please write:
terms of this agreement. Unless you so donate a previous Symantec Customer Sales and Service, 20330 Stevens Creek
version of an upgraded version, upon upgrading the Software, Boulevard, CA 95014.
all copies of the prior version must be destroyed.
SIXTY DAY MONEY BACK GUARANTEE:
If you are the original licensee of this copy of the Software and
are dissatisfied with it for any reason, you may return the
complete product, together with your receipt, to Symantec or
an authorized dealer, postage prepaid, for a full refund at any
time during the sixty day period following the delivery to you
of the Software.
Help! I’ve got a virus.
No
Is Norton AntiVirus
installed?
See “Installing
Norton AntiVirus” on
page 7.
Yes
No
Has Norton AntiVirus
detected a virus?
See “Scanning for

viruses” on page 36.
Yes
See “What to do if a virus

is found” on page 39.
See “Updating
Norton AntiVirus with
LiveUpdate” on page 18.
C O N T E N T S
Chapter 1 Installing Norton AntiVirus

Installing Norton AntiVirus ................................................................... 7
System requirements ...................................................................... 7
Email programs .............................................................................. 8
Emergency procedures .................................................................. 9
Installation procedure .................................................................. 10
Keeping your system protected ......................................................... 11
Automatic LiveUpdate ................................................................. 11
LiveUpdate ................................................................................... 11
Rescue Disks ................................................................................ 12
Uninstalling Norton AntiVirus ............................................................ 12
Chapter 2 Introducing Norton AntiVirus

What’s new in Norton AntiVirus 2001? .............................................. 13
Norton AntiVirus ................................................................................. 14
Protection from harmful code ..................................................... 14
Detection of viruses in compressed files .................................... 14
Email scanning ............................................................................. 14
Quarantine ................................................................................... 14
Updating with LiveUpdate .......................................................... 15
Rescue Disk .................................................................................. 15
Chapter 3 Norton AntiVirus basics

Navigating Norton AntiVirus .............................................................. 17
Setting options ............................................................................. 18
Updating Norton AntiVirus with LiveUpdate ............................. 18
Creating Rescue Disks ........................................................................ 19
Creating Norton Zip Rescue Disks .............................................. 20
Creating basic Rescue Disks ........................................................ 22
Updating Rescue Disks ................................................................ 23
Using help to learn more about Norton AntiVirus ........................... 24
Chapter 4 Responding to Norton AntiVirus alerts

Norton AntiVirus alerts ....................................................................... 27
5
Chapter 5 Preventing viruses with Norton AntiVirus
Understanding and avoiding viruses ................................................. 31
Understanding Trojan Horses ..................................................... 32
Understanding worms ................................................................. 32
What Norton AntiVirus does automatically ....................................... 32
What you have to do .......................................................................... 33
Tips for avoiding viruses ............................................................. 33
Maintaining full-time protection with Auto-Protect .......................... 34
Temporarily disabling Auto-Protect ................................................... 35
Scanning for viruses ........................................................................... 36
Protecting your email ......................................................................... 36
Chapter 6 Norton AntiVirus emergency procedures

What to do if a virus is found ............................................................ 39
Quick guide to alert actions ........................................................ 39
Types of virus alerts .................................................................... 40
What to do if Norton AntiVirus cannot repair ............................ 42
Using Rescue Disks in virus emergencies ......................................... 43
Submitting files to SARC ..................................................................... 45
Chapter 7 Troubleshooting
Service and support solutions
CD Replacement Form
Potential Virus Submission Procedure
Index
6
C H
Installing
A
Norton AntiVirus
P T E R
1
Welcome to Norton AntiVirus, the number one antivirus software in the
world.
Installing Norton AntiVirus

Before installing Norton AntiVirus, take a moment to review the system
requirements listed in this section. Windows 95, Windows 98, and
Windows Me users should have some blank floppy disks available to make
Rescue Disks (or a Zip™ disk and a floppy disk to make a Norton Zip
Rescue™ disk set).
Note: You do not need to uninstall previous versions of Norton AntiVirus

from your system before running Setup, but you should remove any other
antivirus software.
System requirements
To use Norton AntiVirus, your computer must meet the following minimum
requirements.
Windows 95 OSR2 and Windows 98

■ Intel 80486DX/66 processor
■ 32 MB of memory
■ 50 MB of hard disk space
■ CD-ROM disk
7
Windows Me
■ Intel Pentium 150MHz processor
■ 32 MB memory
■ CD-ROM disk
Windows NT 4.0 Workstation

■ Service Pack 4
■ Intel Pentium processor
■ 16 MB of memory (32 MB recommended)
■ CD-ROM disk
Windows 2000 Professional

■ Intel Pentium 133MHZ processor
■ 64 MB of memory
■ CD-ROM disk
While not required, an Iomega Zip drive is a definite advantage when

making a Rescue Disk set.
Note: Norton AntiVirus does not support Iomega Zip or Jaz drives with a
USB interface because there are no DOS drivers available.
Email programs
Norton AntiVirus automatically configures the following email clients for
email protection:
■ Microsoft Outlook Express 4.0/5.x
■ Microsoft Outlook 97/98/2000
■ Netscape Messenger 4.x
■ Eudora Light 3.0
■ Eudora Pro 4.0
■ Pegasus Mail 3.0
8
■ Becky! Internet Mail 1.26

■ Al-Mail 1.11
Norton AntiVirus can protect other POP3 clients, but you must manually
configure the client for protection. See Help for more information.
Emergency procedures
When you install Norton AntiVirus, it scans for viruses in memory. If it
finds an active virus, use Emergency Disks to remove the virus before you
finish installing.
Make Emergency Disks from the Norton AntiVirus CD to help you recover
from the emergency. You will need several formatted 1.44 MB disks.
You can use the CD that contains Norton AntiVirus as an Emergency Disk if
your computer can start up from the CD-ROM drive. See “Using the CD as
an Emergency Disk” on page 10.
Warning: Perform the following procedure on a different computer from

the one with the problem. Executing these steps might cause additional
problems.
To make Emergency Disks:

1 Insert the Norton AntiVirus CD into the CD-ROM drive.
2 Click Browse the CD.
3 Double-click the Support folder.
4 Double-click the Edisk folder.
5 Double-click Ned.exe.
6 Follow the on-screen instructions.
To use the Emergency Disks:

1 If your computer is running, click the Start button, select Shut Down,
and then select the Shut Down option. When Windows has shut down,
switch off your computer using the power switch.
2 Insert Emergency Disk 1 in your floppy drive, and then switch on your
computer.
9

The Emergency program takes several minutes to load, and then it
automatically scans your computer and removes viruses.
If you cannot start up from drive A, see “I cannot start up from my A:
drive” on page 49.
Using the CD as an Emergency Disk

You can use the Norton AntiVirus CD as an Emergency Disk if your
computer can start up from the CD-ROM drive. Wherever the instructions
say to insert Emergency Disk 1 and restart your computer, follow these
steps instead.
To use the CD as an Emergency Disk:

1 Insert the Norton AntiVirus CD into your CD-ROM drive.
2 Restart your computer.
You may need to change your computer’s BIOS Setup options to start
up from the CD-ROM drive. Refer to your computer manual to see
how to change the startup device.
When you are running from the CD, you can skip instructions to insert
other Emergency Disks. All the information for all the Emergency Disks
is on the CD.
Installation procedure
To install:
1 Start Windows (if it is not already running).
2 Close all Windows programs to prevent conflicts.
3 Insert the Norton AntiVirus CD in the CD-ROM drive. An opening
screen appears.
4 Click Install Norton AntiVirus and follow the on-screen instructions.
The preselected options in Setup are the correct choices for most
people. You should accept the preset choices unless you have a very
unusual need.
10
Keeping your system protected
If the opening screen does not appear:

1 Double-click the My Computer icon.
2 Double-click the icon for your CD-ROM drive.
3 Double-click CDSTART.EXE.
4 Click Install Norton AntiVirus and follow the on-screen instructions.
The last step of installation is for you to create Rescue Disks. Rescue Disks
are an important part of your protection. For example, they let you safely
restart your computer if it is halted due to a virus in memory. See “Creating
Rescue Disks” on page 19.
While this user’s guide contains helpful information, there is additional

information in online help that is not covered here. There is also a wealth
of information at http://service.symantec.com.
Keeping your system protected

Norton AntiVirus gives you the tools you need to keep your system
protected.
Automatic LiveUpdate
Automatic LiveUpdate checks for new virus definitions when you are
connected to the Internet. It can update your virus protection without
interrupting your work.
LiveUpdate
The LiveUpdate button at the top of the main screen updates your virus
protection and Norton AntiVirus programs. See “Updating Norton AntiVirus
with LiveUpdate” on page 18.
Norton AntiVirus relies on up-to-date information to detect and eliminate

viruses. One of the most common reasons you may have a virus problem is
that you have not updated your virus protection since you purchased the
product. You should update your virus protection at least once a week.
11
Rescue Disks
Rescue Disks contain critical information your computer needs to start and
run properly. This information changes as you change the configuration of
your computer, so it is important to keep your Rescue Disk set up-to-date.
You should update your Rescue Disks at least once a month, plus any time
you update your virus protection, install new software, or make changes to
your hardware. See “Creating Rescue Disks” on page 19.
Uninstalling Norton AntiVirus

You can easily remove Norton AntiVirus from your computer.
To remove Norton AntiVirus from your computer:

1 Click the Start button, and then select Settings > Control Panel.
2 Double-click Add/Remove Programs.
3 In the list of installed programs, select Norton AntiVirus. Click Add/
Remove.
You might also want to uninstall LiveUpdate and LiveReg if you have
no other Symantec products installed.
12
C H A
Introducing
Norton AntiVirus
P T E R
2
Norton AntiVirus automatically protects against all viruses and Trojan
horses, plus it protects you against malicious ActiveX and Java applets. It
quarantines infected files before they damage your system and provides
help with suspected infections directly from Symantec researchers. Norton
AntiVirus automatically updates virus definitions with LiveUpdate.
What’s new in Norton AntiVirus 2001?

Automatic LiveUpdate checks for new virus definitions when you are
connected to the Internet. It can update your virus protection without
interrupting your work.
SmartScan improves file scanning performance and reduces system impact

from constant background monitoring for viruses. SmartScan determines
what files contain executable code, and then it scans only those files for
viruses and other malicious code.
SmartScan represents a significant security enhancement for users who

scan program files and documents only. SmartScan looks into every file to
determine if there is executable code and it ensures that no files that might
contain viruses escape the scanning engine.
Comprehensive email scanning protection provides added support for

clients with Secure Password Authentication such as MSN. Norton AntiVirus
scans email automatically as it is received from the server and detects
viruses lurking in email attachments before you even save or launch the
attachment, eliminating the risk of unknowingly forwarding viruses to third
parties.
13
Introducing Norton AntiVirus
A new email status window lists what email accounts you have and
whether email protection is enabled for those accounts. It makes it easy to
configure email antivirus protection.
The bootable CD provides antivirus protection that lets you easily recover
from virus emergencies.
Norton AntiVirus
Norton AntiVirus protects you from harmful code that might try to infiltrate
your computer. You are safe from infection whether you are receiving
email attachments, downloading files from the Internet or from a network,
or inserting a floppy disk into your computer.
Protection from harmful code

Norton AntiVirus protects you from malicious code, including viruses,
Trojan horses, ActiveX controls, and Java applets so you’re safe when you
use your computer and when you’re on the Internet.
Detection of viruses in compressed files

Norton AntiVirus checks for viruses and other malicious code inside of
compressed files, such as Zip files. It can even find and fix problems inside
a compressed file that is contained within another compressed file.
Protection is not limited to just Zip files; Norton AntiVirus finds problems
inside many kinds of compressed files.
Email scanning
Norton AntiVirus checks email attachments as you receive them. If a virus
is found, Norton AntiVirus will repair it for you.
Quarantine
When Norton AntiVirus finds a file it can’t repair, it safely isolates the file in
a Quarantine area. This lets you update your virus protection so that you
can fix the problem completely.
14
Norton AntiVirus
Updating with LiveUpdate

LiveUpdate retrieves “micro definitions” that contain just the information
you need to update your virus protection. New virus definitions are posted
on the Symantec website weekly, so you can update your virus protection
every week or allow Norton AntiVirus automatic LiveUpdate to manage
updating for you.
Rescue Disk
Rescue Disks keep you prepared to deal with virus emergencies that can
occur without warning. Rescue Disk records a duplicate set of system
startup files and disk partition information, and stores rescue items plus a
virus scanner on an Iomega Zip disk, across multiple floppy disks, or on a
network drive.
A Norton Zip Rescue Disk set consists of one Zip disk and one bootable
floppy disk. With this disk set, you can start Windows and use Norton
AntiVirus tools to fix virus-related problems.
A basic Rescue Disk set consists of one bootable floppy disk and several
additional disks. With this kind of Rescue Disk set, you can start your
computer in DOS mode and use Norton AntiVirus to fix virus-related
problems.
Note: Rescue Disk is not needed, and therefore not installed, with
Windows NT and Windows 2000.
15
Introducing Norton AntiVirus
16
C H A P
Norton AntiVirus basics

T E R
3
This chapter provides you with the basics of using Norton AntiVirus.
Navigating Norton AntiVirus

To start Norton AntiVirus:
1 On the Windows taskbar, click Start > Programs > Norton AntiVirus >
Norton AntiVirus 2001.
The Norton AntiVirus main screen is the starting point for all your
activities.
17
2 From here you can do the following:

■ Click an option on the left to see a description of what it provides
on the right.
■ Click one of the buttons at the top for features that apply to more
than one area of the program.
Additional Symantec products might appear if you have them installed.
Setting options
There are many options you can set in Norton AntiVirus. For example, you
can choose to scan all files, instead of scanning program files and
documents only.
To set options:
1 Click the Options button at the top of the Norton AntiVirus main
window.
2 Choose the feature for which you want to set options.
Updating Norton AntiVirus with LiveUpdate

Click the LiveUpdate button to update Norton AntiVirus programs and
virus protection. LiveUpdate connects to Symantec to see if updates are
available for Norton AntiVirus and also checks for updates to your virus
protection. LiveUpdate requires an Internet connection.
Note: Symantec does not charge for updates to Norton AntiVirus programs,
however there is a charge for updating your virus protection after your free
subscription expires.
Note: Your normal Internet access fees apply.
18
Creating Rescue Disks
To update Norton AntiVirus using LiveUpdate:

1 Click the LiveUpdate button at the top of the Norton AntiVirus main
window.
2 The LiveUpdate window appears. Follow the on-screen instructions.
Tip: If you connect to the Internet through AOL, CompuServe, or Prodigy

Internet, first connect to the Internet, and then run LiveUpdate.

Rescue Disks contain critical information your computer needs to start and
run properly. This information changes as you change the configuration of
your computer, so it is important to keep your Rescue Disks up-to-date.
Note: If you use Windows NT or Windows 2000 you won’t have the option
to make Rescue Disks. Windows NT and Windows 2000 provide built-in
protection against the problems that require Rescue Disks, so they are not
necessary.
If you have an Iomega Zip drive, Rescue Disk can use it to make Rescue
Disks that let you start Windows even when your computer will not start
up normally after a system crash. This lets you make emergency repairs.
You can also make Rescue Disks using your standard floppy drive and
several floppy disks. This floppy-based set lets you start up to the DOS
operating system only, and access DOS-based utilities. Both kinds of
Rescue Disks provide you with an easy-to-use interface for recovering from
a system crash.
Caution: Never use Rescue Disks made on another computer. Rescue

Disks contain information specific to the computer on which they were
made.
Tip: The more recent your Rescue Disks, the better your chances of a full
recovery. Update your Rescue Disks whenever you update your virus
protection, install new software, or make changes to your hardware.
19
Creating Norton Zip Rescue Disks

A Norton Zip Rescue Disk set consists of two disks:
■ Bootable floppy disk
■ Zip disk
You need both of these disks to successfully restore your system after a
crash. The floppy disk contains the DOS system files necessary to start up
your computer. The Zip disk contains the Windows operating system, as
well as the startup files, configuration information, and Norton AntiVirus
programs necessary to restore your computer.
Note: Some computer manufacturers replace the standard floppy disk drive
with a Zip drive. In this case, your Rescue Disk set will not include a
bootable floppy disk. Rescue Disk creates a bootable Zip disk that contains
all required Rescue Disk information.
Tip: Rescue disks contain system settings and rescue files. They do not
back up your data. Be sure to make adequate backups of all your data.
To create a Norton Zip Rescue Disk set:

1 Click the Rescue button at the top of the Norton AntiVirus main
window.
2 Insert a Zip disk in your Zip drive and a floppy disk in your A: drive.
Note: Do not use disks that contain data that you want to save. Rescue
Disk overwrites all information on the disks.
Tip: You can also use an Iomega Jaz drive when making this kind of
Rescue Disk.
20
3 Select Norton Zip Rescue in the Choose Rescue Type group box.
Caution: If you have multiple Zip drives installed on one computer,

make sure to always use the same Zip drive when creating, updating,
and using your Norton Zip Rescue Disks.
4 Click Create.
Rescue Disk formats both the floppy and Zip disks and copies your
computer’s essential startup information to the disks.
5 Click Restart to test your newly created Rescue Disks.
6 If the Rescue Disk window appears on the screen, the Rescue Disk
works properly. If the Rescue Disk window does not appear, the
Rescue Disk does not work properly.
Caution: Do not continue with the rescue process when you are
testing Rescue Disks. “Repairing” a system that is functioning properly
can cause problems.
If your Rescue Disk does not work, see “My Rescue Disk does not
work” on page 47.
7 Remove the disk from the A: drive and slide open the plastic tab on
the back of the disk to write-protect it. This prevents you from
accidentally changing the data stored on the disks.
8 Shut down Windows if it is running. Turn the power off and on again
to restart your computer.
21
Creating basic Rescue Disks

Basic Rescue Disks give protection that is indispensable in protecting your
computer from disasters. Basic Rescue Disks let you start up your computer
to DOS after a system crash and use the DOS-based utilities to fix many
problems.
You save your Rescue Disk set to a series of 1.44 MB floppies or a hard
drive to which you have access.
To create basic Rescue Disks:

window.
2 Select Basic Rescue in the Choose Rescue Type group box.
3 Select the drive you want Rescue Disk to use to create the Rescue Disk
set. To create a floppy-based disk set select your A: drive.
Caution: If you select a network drive, a second physical hard disk, or

some other large capacity disk drive, your Rescue Disk set is placed in
a folder on the selected disk. Make sure to make a bootable floppy or
Zip disk and keep it in a safe location. This disk should contain the
network drivers or other files necessary to start your computer and
access the drive on which you placed your Rescue Disk set. Do not
create your Rescue Disk set on your C: drive.
4 Insert a floppy disk into your A: drive.

5 Click Create.
Rescue Disk formats the disk and copies your computer’s essential
startup information to the disk.
6 Insert additional disks as required. Label the disks as you insert them.
7 Click Restart to test your newly created Rescue Disks.
8 If the Rescue Disk screen appears on the screen, the Rescue Disk
works properly. If the Rescue Disk screen does not appear, the Rescue
Disk does not work properly.
can cause problems.
work” on page 47.
22
Updating Rescue Disks

Because your Rescue Disks contain information about your computer that
can change, it is vital that you keep your Rescue Disks current.
You can update your Rescue Disks as often as you like. Rescue Disk lets
you quickly and easily update Zip and basic Rescue Disks without having
to recreate them.
Caution: The update feature can track one set of each type of Rescue
Disk. If for some reason you choose to keep more than one basic Rescue
Disk set or more than one Norton Zip Rescue Disk set, do not use this
feature.
To update your Rescue Disks:

window.
2 Select the type of Rescue Disk set you are updating in the Choose
Rescue Type group box.
3 Specify the location of your Rescue Disks:
■ For Norton Zip Rescue Disks, insert the Zip disk into your Zip drive
and the floppy disk into your floppy drive.
■ For basic Rescue Disks, select the drive in the Select Destination
Drive list box. If you are updating floppy-based Rescue Disks, slide
closed the plastic tab on the back of the disk and insert the first
disk of the set into your A: drive.
Caution: If you have multiple Zip drives installed on one computer,

make sure to always use the same Zip drive when creating, updating,
and using your Norton Zip Rescue Disks.
4 Click Update.
Rescue Disk updates your computer’s essential startup information on
the disks.
23
5 Click Restart to test the newly updated Rescue Disks.

6 If the Rescue Disk screen appears on the screen, the Rescue Disk
works properly. If the Rescue Disk screen does not appear, the Rescue
Disk does not work properly.
can cause problems.
work” on page 47.
Using help to learn more about Norton AntiVirus

Norton AntiVirus provides extensive online help. This help system gives
you detailed instructions about how to use all of Norton AntiVirus.
Norton AntiVirus includes three kinds of help:

■ Help with program dialog boxes
■ How To help
■ What’s This? help
Help with program dialog boxes

The Help dialog box provides information about the area of the program
you are using. This kind of help is context-sensitive, meaning that it
displays help for the specific dialog box that you are currently using.
24
Using help to learn more about Norton AntiVirus
To get help with a dialog box:

■ Click the Help button located in the dialog box.
A help topic pertaining to the current dialog box appears.
Complete table of
contents and index
Information about
the dialog box and
how to use it
How To help
How To help explains step-by-step procedures you are likely to perform
using Norton AntiVirus. You can access these topics through the Contents
or Index tabs. Open the Contents and Index by clicking the Help Topics,
Contents, or Index button at the top of any help topic.
What’s This? help

What’s This? help provides a quick definition of an individual component
of a window or dialog box.
To access What’s This? help:

■ Right-click anywhere you need help in a window or dialog box and
choose What’s This?
25
Getting help from the Help menu

Help is always available from the Norton AntiVirus main window.
To access the Help menu:

■ Click Help at the top of the main Norton AntiVirus window.
Online help table of

contents and index
Visit Symantec
Version and websites for more
registration information
information
26
C H A
Responding to
P
Norton AntiVirus alerts

T E R
4
When Norton AntiVirus detects a problem with your system it displays a
message on your screen. These messages, called alerts, take several forms.
These alerts may appear when you are running other programs and
Norton AntiVirus detects a problem. This chapter shows examples of the
various types of alerts that you may see, and tells you what actions you
should take to respond to them.

Norton AntiVirus displays different alerts, depending on when it finds a
virus or notices virus-like activity.
Virus Alerts
These messages appear when Norton AntiVirus detects viruses, Trojan
horses, and other types of malicious code.
27
Responding to Norton AntiVirus alerts
If you see this type of alert:
■ Click Next. The wizard will help you fix the problem.
If you see this type of alert:
1 Look for words that identify the type of problem. Read the whole
message.
2 Press Enter to choose the action that is preselected for you.
For more information, find the type of problem in “Types of virus alerts”
on page 40. For example, if the message says VIRUS IN MEMORY, look for
“VIRUS IN MEMORY.”
28
If you see an alert like this:
1 Click OK (possibly several times).

2 Scan your disk to eliminate the virus. See “Scanning for viruses” on
page 36.
29
Responding to Norton AntiVirus alerts
30
C H A P
Preventing viruses with

Norton AntiVirus
T E R
5
Understanding and avoiding viruses
A computer virus is a computer program written by an ill-intentioned
programmer. Your computer can catch a virus from disks, a local network,
or the Internet. Just as a cold virus attaches itself to a human host, a
computer virus attaches itself to a program. And just like a cold, it is
contagious.
What viruses do:

■ Take control of your computer without your knowledge.
■ Cause your computer to behave strangely, for example, beep or
display annoying messages.
■ Hide in macros that infect and spread throughout Word and Excel
documents. (These are called macro viruses.)
■ Cause serious destruction to your files. Viruses can damage data, delete
files, and can even completely erase your hard drive.
■ Remain inactive until a predetermined trigger date (for example, Friday
the 13th) to wreak havoc.
What viruses do not do:

■ Infect or damage hardware, such as keyboards or monitors. You may
experience strange behaviors (such as characters appearing upside
down) but your disks are not physically damaged, just what is stored
on them.
31
Preventing viruses with Norton AntiVirus
Understanding Trojan Horses

A Trojan Horse, while not technically a virus, has the potential to cause the
same kinds of problems that viruses do. Many Trojan Horses are designed
to steal your login ID and password and then email them to someone else
who can make use of the account at your expense. Other Trojan Horses
display obscene messages or delete the contents of your hard drive.
You typically get Trojan Horses by downloading a program that seems safe
or promises something like free online time. Once it is downloaded and
executed, the malicious code begins to work. The difference between
Trojan Horses and viruses is that Trojan Horses do not replicate or spread
on their own. They can only be transmitted intentionally via email or disk,
or downloaded directly onto a PC. This means that, unlike a virus, you are
typically only affected once by a specific Trojan Horse.
Understanding worms
Like viruses, worms replicate themselves. However, instead of spreading
from file to file they spread from computer to computer, infecting an entire
system.
Worms copy themselves from one computer to another over a network

(using e-mail, for example). Because worms don’t require human
interaction to replicate, they can spread much more rapidly than computer
viruses.
What Norton AntiVirus does automatically

Norton AntiVirus safeguards your computer from virus infection, no matter
what the source. You are protected from viruses that spread from hard
drives and floppy disks, those that travel across networks, and even those
that are downloaded from the Internet. Norton AntiVirus protects your
computer in the following ways:
■ Eliminates viruses and repairs files.
■ Makes sure your computer is safe from viruses at startup.
■ Checks for viruses every time you use programs on your computer,
floppy disks, and document files that you receive or create.
■ Checks for viruses in email attachments each time you receive email
from the Internet.
32
What you have to do
■ Monitors your computer for any unusual activities that may indicate an
active virus.
■ Runs a scheduled scan automatically once per week to confirm that
your hard drives are virus-free. Even files within compressed files are
scanned.
■ Provides complete protection from Internet-borne viruses. No separate
programs or Norton AntiVirus options changes are necessary.
Auto-Protect scans program and document files automatically as they
are downloaded.
■ When Automatic LiveUpdate is enabled, Norton AntiVirus checks for,
and installs, updated virus protection when you are connected to the
Internet.
What you have to do

New viruses are being written all the time so you have to regularly update
your virus protection. If you do not, you are not protected against viruses
that have been released into the computer world since you bought the
product.
■ Keep your virus protection up-to-date. Automatic LiveUpdate does this
for you automatically. Or, you can update your protection at any time
with LiveUpdate. To update virus protection, see “Updating
Norton AntiVirus with LiveUpdate” on page 18.
■ Update your Rescue Disks each time you update your virus protection
or make changes to your computer’s hardware or operating system (for
example, when you add a disk drive). To update Rescue Disks, see
“Updating Rescue Disks” on page 23.
Tips for avoiding viruses

To avoid computer viruses, follow these rules:
■ Get in the habit of looking for the Norton AntiVirus Auto-Protect icon
in the taskbar on your Windows desktop. Be sure Norton AntiVirus
Auto-Protect is enabled at all times. You can also start Norton AntiVirus
and check that Real-time scanning (Auto-Protect) is enabled.
■ Regularly update your virus protection from Symantec to keep up with
the new viruses that have been released since you installed Norton
AntiVirus.
33
■ Be cautious about unexpected email and email with attachments that

might contain a virus.
■ Buy legal copies of all software you use and make write-protected
backup copies.
■ Scan all files on disks you receive from other people. To scan disks,
see “Scanning for viruses” on page 36.
Maintaining full-time protection with Auto-Protect

Norton AntiVirus is preset to provide you with complete protection against
viruses. It is unlikely you need to change any settings. However, you can
ensure that Auto-Protect is working by following these steps.
To ensure that Auto-Protect is enabled:

1 Start Norton AntiVirus.
2 Check that it says that Real-time scanning (Auto-Protect) is enabled. If
it is disabled, double-click the Real-time scanning (Auto-Protect) line
and click Yes.
3 Click the Options button at the top of the Norton AntiVirus main
window.
4 Click Auto-Protect in the list on the left.
5 Be sure that Start Auto-Protect When Windows Starts Up is checked.
34
Temporarily disabling Auto-Protect
Tip: For maximum protection, your Auto-Protect options should be set as

shown below.
Temporarily disabling Auto-Protect

Every time you start your computer, Norton AntiVirus Auto-Protect lets you
know it is working. The Auto-Protect icon in the lower-right corner of the
taskbar on your Windows desktop reminds you that you are fully protected
against virus infection.
You are sometimes told to disable your antivirus software when you are
installing new programs. In this case, disable Auto-Protect temporarily and
then turn it back on again.
To turn off Norton AntiVirus Auto-Protect temporarily:

■ Right-click the Norton AntiVirus Auto-Protect icon on the taskbar in the
lower-right corner of your Windows desktop, and then click Disable
Auto-Protect.
35
To turn on Norton AntiVirus Auto-Protect:

■ Right-click the Norton AntiVirus Auto-Protect icon on the taskbar in the
lower-right corner of your Windows desktop, and then click Enable
Auto-Protect.
Scanning for viruses

You should scan all floppy disks for viruses before you use them.
To scan drives for viruses:

2 In the Norton AntiVirus main window, click Scan For Viruses.
3 Select the item you want to scan from the list.
If what you want to scan is not in the list, click Add Scan to start the
Scan Wizard, which will help you build a custom scan.
4 Click Run Scan Now.
To quickly scan a drive, folder, or file, right-click an item in My Computer

or Windows Explorer and choose Scan With Norton AntiVirus.
Protecting your email

Norton AntiVirus scans your email by intercepting it before it reaches your
email program. It does this by modifying the user name and server name in
your email client program. The server name is changed to
Pop3.norton.antivirus, and the user name is changed to a combination of
your user name and email server name. See help for details about these
settings, as well as how to configure a POP3 email client that Norton
AntiVirus does not recognize.
When Norton AntiVirus is scanning incoming email, the email scanning

icon appears in the notification area of the Windows taskbar.
When you are downloading a large attachment, your email program might
display a warning because it is not receiving information fast enough. This
is because Norton AntiVirus must check the entire attachment before
passing it on to the email client. If you see this kind of a message, you
should enable Protect Against Timeouts When Scanning Email.
36
Protecting your email
To ensure that timeout protection is enabled:

2 At the top of the Norton AntiVirus main window, click the Options
button.
3 In the list on the left, expand Email Protection.
4 Click Advanced.
5 Make sure Protect Against Timeouts When Scanning Email is checked.
37
38
C H A
Norton AntiVirus
emergency procedures
P T E R
6
What to do if a virus is found
When you see one of the Norton AntiVirus alerts shown in “Responding to
Norton AntiVirus alerts” on page 27, you can use the information in this
chapter to help you respond appropriately.
Quick guide to alert actions

Most virus alerts can be handled directly from the alert that appears on
your screen. The recommended action is always pre-selected.
If a Norton AntiVirus alert appears on your screen, and you are not sure
what option to select, use this table to decide what to do. If you need more
information, see “Types of virus alerts” on page 40 for step-by-step
instructions.
In some situations, your mouse will not work when an alert appears. In
these cases, press the first letter of your selection (for example, press R for
Repair) or press Enter to accept the recommended selection.
Actions When and why you use them
Eliminates the virus and repairs the infected item. When a virus is
found, Repair is always the best choice.
Isolates the virus-infected file, but does not remove the virus.
Select Quarantine if you suspect the infection is caused by an
unknown virus and you want to submit the virus to the Symantec
AntiVirus Research Center for analysis.
39
Norton AntiVirus emergency procedures
Actions When and why you use them
Erases both the virus and the infected file. The virus and file are
gone forever. Select Delete if Repair is not successful. Replace a
deleted file from the original program disks or backup copy. If
the virus is detected again, your backup copy or original disk is
infected.
Stops the current operation to prevent you from using an infected

file. Stop does not solve the problem. You will be alerted again
the next time you do the same thing.
Continues the current operation. Select Continue only if you are

sure a virus is not at work. You will be alerted again. If you are
not sure what to do, select Stop.
If you select Exclude and a virus is at work, the virus will not be
detected. Exclude should be used only by system administrators
for system tuning.
Types of virus alerts
VIRUS FOUND
When Norton AntiVirus finds a virus has infected a file on your computer, it
produces a warning similar to this:
VIRUS FOUND: The BADVIRUS virus was found in C:\MYFILE.
To get rid of a virus infection:

■ Press R for Repair.
Your file is restored to exactly the way it was before the virus infected it.
That is all you need to do. If the repair was successful, the virus is gone
and your computer is safe.
If Norton AntiVirus cannot repair the infection, see “What to do if Norton

AntiVirus cannot repair” on page 42.
VIRUS IN MEMORY
Norton AntiVirus stops your computer when it finds a virus in memory.
While you do not normally turn off a computer without first exiting
Windows, in this case it is necessary because your computer is halted. You
cannot do anything else.
40
What to do if a virus is found
A virus in memory is active, dangerous, and will quickly spread to many

other files.
A memory virus warning says similar to this:

VIRUS IN MEMORY. The BADVIRUS virus was found in memory.
The computer is halted. Restart from your write-protected Rescue Disk, and
then scan your drive again.
To get rid of a virus in memory:

1 Turn off your computer using the power switch.
2 Insert your Rescue Boot Disk into the A: drive.
3 After waiting a few seconds, turn the computer on.
If you do not have Rescue Disks, see “The alert tells me to use my
Rescue Disks, but I did not create them” on page 48.
4 Follow the on-screen directions.
If you cannot start up from the A: drive, see “I cannot start up from my
A: drive” on page 49.
VIRUS-LIKE ACTIVITY
A virus-like activity alert does not necessarily mean that your computer has
a virus. It is simply a warning. It is up to you to decide whether the
operation is valid in the context in which it occurred.
The alert looks similar to this:

VIRUS-LIKE ACTIVITY: The NEWGAME is attempting to write to
IO.SYS.
To resolve a virus-like activity alert:
Do one of the following:

■ Press C for Continue if the message describes a valid activity for
the application you are running.
For example, if you are updating an application and the alert warns
you of an attempt to write to a file, the activity is valid.
■ Press S for Stop if the detected activity is not related to what you
are trying to do.
For example, if you are playing a game and the alert warns you of an
attempt to write to the boot records of your hard drive, the activity is
invalid.
41
What to do if Norton AntiVirus cannot repair

One of the most common reasons Norton AntiVirus cannot repair a file is
that you do not have the most up-to-date virus protection. Use LiveUpdate
to obtain the latest virus protection.

■ Update your virus protection and scan again. For details, see “Updating
Norton AntiVirus with LiveUpdate” on page 18.
■ Read the information on your screen carefully to identify the type of
item that cannot be repaired, and then match it to one of the types
below:
■ Infected files are those with filename extensions such as .EXE,
.DOC, .DOT, or .XLS. Files with any name can be infected.
■ Hard disk master boot record, boot record, or system files (such as
IO.SYS or MSDOS.SYS) and floppy disk boot record and system
files are replaced using the Rescue Disks or, sometimes, your
operating system (Windows or DOS) disks.
Infected files
If infected files cannot be repaired, you need to either quarantine or delete
them from your computer. If you leave an infected file on your computer,
the virus infection can spread.
Note: Some infections can be removed by special removal tools that are on
the Norton AntiVirus CD in the Support\NAVTools\Repair folder. These
tools are also available on the Symantec Web site. Go to
http://www.symantec.com/avcenter/ and see if there is a removal tool
available for your problem.
If Norton AntiVirus cannot repair a file:

■ Select Quarantine (recommended).
After the file is quarantined, you can update your virus definitions and
scan again or submit the file to SARC for analysis.
42
Using Rescue Disks in virus emergencies
■ Select Delete.
Replace the deleted document file with a backup copy or reinstall a
deleted program from the original program disks. Make sure to scan
the backup disks before you use them.
If the virus is detected again after you replace or reinstall the file, your
backup copy or original program disks are probably infected. You can
try contacting the manufacturer for a replacement.
Hard disk master boot record or boot record

Hard disk master boot record, boot record, and system files (such as
IO.SYS or MSDOS.SYS) are replaced using the Rescue Disks or, sometimes,
your operating system (Windows or DOS) disks.
If Norton AntiVirus cannot repair your hard drive or master boot record,
you can use your up-to-date Rescue Disks to restore it. For details, see
“Using Rescue Disks in virus emergencies” on page 43.
If your Rescue Disks are not up-to-date, contact Symantec Technical

Support. See “Service and support solutions” on page 53.
System file
If Norton AntiVirus cannot repair a system file (for example, IO.SYS or
MSDOS.SYS) you cannot delete it. You must reinstall Windows.
Restart your computer from an uninfected, write-protected floppy disk and

reinstall Windows. You can use your Rescue Boot Disk or the Windows
Startup Disk that you created when you installed Windows to start up.
Using Rescue Disks in virus emergencies

Sometimes a virus infection prevents your computer from starting normally.
Some viruses can only be removed if the computer is started from a clean
disk, not the infected hard drive. Often, a Norton AntiVirus alert will tell
you when to use your Rescue Disks.
You first need to determine whether your Rescue Disks are current. This
means that you have created or updated your Rescue Disks since you last
did any of the following:
■ Added, modified, or removed internal hardware
43
■ Added, modified, or removed hard drive partitions (with software such

as Partition-It or Partition Magic)
■ Upgraded your operating system (to Windows 98, for example)
Caution: If the critical information stored on the Rescue Boot Disk is

outdated, it could cause problems when you attempt to restore your
computer. It is unlikely you would be able to fix these problems on your
own. However, if you have current Rescue Disks, the following procedure
is safe to attempt.
Note: It’s OK if you have updated your virus protection since you last
updated your Rescue Disks. They may not be able to recognize every new
virus, but they will not harm your system simply because the virus
protection is out-of-date.
Tip: If your Rescue Disks are not current (see the Caution above) you can
still use them to remove viruses from your computer. When the Rescue
Disk screen starts from the Rescue Boot disks, use only the Norton
AntiVirus task.
To use your Rescue Disks:

1 If your computer is running, choose Shut Down from the Windows
Start menu, and then switch off your computer using the power switch.
2 Place your write-protected Rescue Boot Disk in the A: drive.
Note: Slide open the plastic tab on the back of the disk to write-protect
it. This prevents a virus from accidentally changing the data stored on
the disks.
3 After waiting a few seconds, turn your computer on.

4 Follow the on-screen directions.
Tip: If your Rescue Disks are not current (see the Caution above) you
can still use them to remove viruses from your computer. When Norton
Rescue starts from the Rescue Boot disks, use only the Norton
AntiVirus task.
You are prompted when it is time to insert other Rescue Disks.
44
Submitting files to SARC
5 When the process is complete, remove the Rescue Disk from the A:
drive and restart your computer.
Note: Virus emergencies are handled by the first two tasks in Norton
Rescue: Rescue Recovery and Norton AntiVirus. You should not need
any additional tasks listed in Norton Rescue to solve virus emergencies.
Submitting files to SARC

Even though you performed a virus scan using the latest virus definitions,
and Norton AntiVirus did not detect a virus, you suspect that your
computer has a virus. Place the suspect file in Quarantine. This ensures
that the virus doesn’t spread. Then, use Scan and Deliver to submit the file
to the Symantec AntiVirus Research Center (SARC).
Follow these steps to submit a sample of the suspected virus to the SARC
for testing.
Note: If the file is compressed, for example, a .zip file, you will have to
uncompress it before you submit it. Scan and Deliver cannot submit
compressed files.
To place a file in Quarantine:

2 In the Norton AntiVirus main window, click Reports.
3 Double-click View and manage the items in Quarantine.
4 In Norton AntiVirus Quarantine, click Add Item.
5 In the Add to Quarantine dialog box, browse to and select the file that
you want to place in Quarantine.
6 Click Add.
When the file is placed in Quarantine, it is encrypted, and is no longer
a threat to the computer.
45
To submit a quarantined file to SARC using Scan and Deliver:

1 Select the file that you want to submit in the right pane of the
Quarantine window.
2 Click Submit Item.
46
C H A
Troubleshooting
P T E R
7
The information in this chapter will help you solve the most frequent
problems that you may experience. If you can’t find the solution to your
problem here, there is a wealth of information on the Symantec Web site.
You can find a troubleshooter, updates, patches, online tutorials,
knowledge base articles and virus removal tools. Go to http://
service.symantec.com.
My Rescue Disk does not work

Due to the number of product-specific technologies used by manufacturers
to configure and initialize hard drives, we cannot always create a bootable
Rescue Disk automatically. If your Rescue Boot Disk does not work
properly, do one of the following:
■ If you have a special startup disk for your computer, add it to your
Rescue Disk set. In an emergency, start up from that disk (first slide
open the plastic tab on the back of the disk to make sure it is
write-protected). Remove the disk and insert your Rescue Boot Disk.
At the DOS prompt, type A:RSHELL, press Enter, and then follow the
on-screen instructions.
■ Use the Disk Manager or similarly named program that came with your
computer to make your Rescue Boot Disk bootable. Make sure to test
your modified Rescue Boot Disk.
■ If you are having trouble with a Norton Zip Rescue Disk set, check the
TROUBLE.TXT file on the Rescue Boot Disk. At the DOS prompt, type
A:VIEW < TROUBLE.TXT and then press Enter.
47
Troubleshooting
Sometimes, your Rescue Boot Disk does not work properly because you
have more than one operating system installed, such as Windows NT and
Windows 95. To modify the disk, do the following:
■ Start up from your hard drive, insert your Rescue Boot Disk into the A:
drive, and, from a DOS prompt, type SYS A: and press Enter. This
transfers the operating system to the Rescue Boot Disk. Be sure to
retest your Rescue Disks.
Tip: See “Creating Rescue Disks” on page 19.
The alert tells me to use my Rescue Disks, but I did not

create them
With your Norton AntiVirus CD you can create Emergency Disks. Although
they are not as powerful as the Rescue Disks you create, you can use the
Emergency Disks to recover from most common emergencies. See “To
make Emergency Disks:” on page 9.
You can use the CD that contains Norton AntiVirus as an Emergency Disk if
your computer can start up from the CD-ROM drive. See “Using the CD as
an Emergency Disk” on page 10.
Once you have created the Emergency Disks, use them to solve the
problem.
To use Emergency Disks:

1 Turn off your computer using the power switch.
2 Insert the Emergency Boot Disk in your A: drive.
3 Turn on your computer.
Your computer will start up from the Emergency Disk.
4 Press Enter to start the Emergency program.
The Emergency program takes several minutes to load, and then
automatically scans your computer and removes viruses.
48
I cannot start up from my A: drive
There are three likely reasons for this:
■ If your computer does not check your A: drive first on startup, you
need to change settings, usually using your computer’s Setup program.
Caution: Be careful when making changes using your computer’s

Setup program. If you have never used it before, you may want to
refer to your computer manufacturer’s documentation.
Complete these steps to change the settings:

a Restart your computer.
A message like this appears telling you the key or keys to press to
run SETUP:
Press <DEL> if you want to run SETUP.
b Press the key or keys to launch the Setup program.
c Set the Boot Sequence to A: C:.
Setup programs vary from one manufacturer to the next. If you
cannot find the Boot Sequence option, use the Setup program’s
help system, refer to the documentation that came with your
system, or contact your system’s manufacturer.
d Save the changes, and then exit the Setup program.
■ You need to use a special Boot Disk rather than the Rescue Boot Disk.
In this case, use the boot disk or startup disk that came with your
computer.
■ Your computer is set up with more than one operating system, such as
Windows NT and Windows 95. For more information, see “My Rescue
Disk does not work” on page 47.
Norton AntiVirus Auto-Protect does not load when I start

my computer
If the Norton AntiVirus Auto-Protect icon does not appear in the
lower-right corner of the taskbar on your Windows desktop, Auto-Protect
is not loaded. There are two likely reasons this is happening:
■ You started Windows in safe mode. Windows restarts in safe mode if
the previous shutdown did not complete successfully. For example,
you may have turned off the power without choosing Shut Down from
the Windows Start menu.
49
Troubleshooting
Choose Shut Down from the Windows Start menu, select the Restart
option, and then click OK.
■ Norton AntiVirus is not configured to start Auto-Protect
automatically.
a Click the Options button at the top of the Norton AntiVirus main
window.
b Click Auto-Protect in the list on the left.
c Be sure that Start Auto-Protect When Windows Starts Up is
checked.
I have scanned and removed a virus, but it keeps infecting

my files
There are several reasons a virus may continue to infect files:
■ The virus might be in a program file with an unusual extension that
Norton AntiVirus is not set to look for. Do this:
a Click the Options button at the top of the Norton AntiVirus main
window.
b Click Manual Scans in the list on the left.
c Select the All Files option in the What To Scan group.
d Expand Manual Scans.
e Click Bloodhound.
f Set the Heuristics Sensitivity Level to Highest Level Of Protection.
g Click OK to save your settings and close the Options dialog box.
h Scan all disks that you use and repair all infected files.
■ The source of the infection is a floppy disk. Scan all the floppy
disks you use to ensure they are free of viruses.
■ The virus may remain in memory after you remove it from the
boot record. It then reinfects your boot record. Use your Rescue
Disks to remove the virus. See “Using Rescue Disks in virus
emergencies” on page 43.
Norton AntiVirus cannot repair my infected files

The most common reason that Norton AntiVirus cannot repair your infected
files is that you do not have the most current virus protection on your
computer. You should update your virus protection regularly to protect your
computer from the latest viruses.
50
■ Click the LiveUpdate button at the top of the main window to update
your virus protection.
If after using LiveUpdate the virus still can not be repaired, the file may be
corrupted, or contain a new virus. There are two additional options:
■ Quarantine the file and submit to SARC. See “Submitting files to SARC”
on page 45.
■ If a non-infected copy of the file exists, delete the infected file and
replace it with the non-infected file.
Some Norton AntiVirus features are password-protected, and

I do not know the password
Uninstall Norton AntiVirus, and then reinstall it. This will remove the
password.
I get an error when testing basic Rescue Disks

If you get the message “Non-system disk, replace disk and press any key”
when testing your Rescue Disks, Rescue may not have prepared the floppy
boot files correctly.
To repair this without having to reformat the disk and create a new
Rescue Disk set:
1 Remove the Rescue Disk and restart your computer.
2 Insert the Rescue Disk into the floppy drive.
3 On the Windows taskbar, click Start > Run.
4 In the Run dialog box, type:
SYS A:
5 Click OK.
51
Troubleshooting
I can’t receive email

If you experience trouble downloading email when Norton AntiVirus email
protection is enabled, try the following:
■ Temporarily disable email protection. This might allow the problem
email to be download so that you can once again enable email
protection. You are protected by Auto-Protect while email protection is
disabled. See “To temporarily disable email protection:” on page 52.
■ Be sure that POProxy is running. POProxy is the Norton AntiVirus
email scanner, and it should start when you start Windows.
To resolve this, make sure that “POProxy” starts with Windows. To
determine if POProxy is running, press Ctrl+Alt+Del to display the
Windows Task List. Look for a program called POProxy.
If you do not see POProxy listed, add a shortcut from the \Program
Files\Norton AntiVirus\POProxy.exe file to your computer’s Startup
folder. For more information about how to create Shortcuts and about
your computer’s Startup folder, please refer to Windows Help.
■ If you continue to experience problems downloading email, disable
email protection. See “To disable email protection:” on page 52.
■ Manually reconfigure your email client. If disabling email protection
does not solve your problem, you might have to manually reconfigure
your email client. In your email client program, change the user name
and POP3 server name to the values provided by your ISP. See help for
more information.
To temporarily disable email protection:

1 At the top of the Norton AntiVirus main window, click Options.
2 Click Internet > Email Protection in the list on the left.
3 Clear the check mark next to the email client.
4 Download your email.
5 Reenable email protection.
To disable email protection:

1 At the top of the Norton AntiVirus main window, click Options.
2 Click Internet > Email Protection in the list on the left.
3 Clear the check mark next to the email client.
52
S U P P O R T
Service and support information is available from the Help system of your
Symantec product. Click the Service and Support topic in the Help index.
Technical support
Symantec offers several technical support options:
■ StandardCare support
Connect to the Symantec Service & Support Web site at
http://service.symantec.com, then select your product and version.
This gives you access to product knowledge bases, interactive
troubleshooter, Frequently Asked Questions (FAQs), and more.
■ PriorityCare, GoldCare, and PlatinumCare support
Fee-based telephone support services are available to all registered
customers. For complete information, please call our automated fax
retrieval service at (800) 554-4403 and request document 933000.
For telephone support information, connect to
http://service.symantec.com, select your product and version, and
click Contact Customer Support.
■ Automated fax retrieval
Use your fax machine to receive general product information, fact
sheets, and product upgrade order forms by calling (800) 554-4403. For
technical application notes, call (541) 984-2490.
53
Support for old and discontinued versions

When a new version of this software is released, registered users will
receive upgrade information in the mail. Telephone support will be
provided for the old version for six months after the release of the new
version. Technical information may still be available through the Service &
Support Web site (http://service.symantec.com).
When Symantec announces that a product will no longer be marketed or

sold, telephone support will be discontinued 60 days later. Support will be
available for discontinued products from the Service & Support Web site
only.
Customer service
Visit Symantec Customer Service online at http://www.symantec.com/
techsupp/news/custserv.html for assistance with non-technical questions
and for information on how to do the following:
■ Subscribe to the Symantec Support Solution of your choice.
■ Obtain product literature or trialware.
■ Locate resellers and consultants in your area.
■ Replace missing or defective CD-ROMS, disks, manuals, and so on.
■ Update your product registration with address or name changes.
■ Get order, return, or rebate status information.
■ Access customer service FAQs.
■ Post a question to a Customer Service representative.
For upgrade orders, visit the online upgrade center at:

http://www.symantec.com/upgrades/ or call the Customer Service Order
Desk at (800) 568-9501.
Worldwide service and support

Technical support and customer service solutions vary by country. For
information on Symantec and International Partner locations outside of the
United States, please contact one of the service and support offices listed
below, or connect to http://www.symantec.com, select the country you
want information about, and click Go!
54
Service and support offices
North America
Symantec Corporation http://www.symantec.com/
175 W. Broadway (Fax: (541) 984-8020
Eugene, OR 97401
Automated Fax Retrieval (800) 554-4403

(541) 984-2490
Argentina, Chile, and Uruguay

Symantec Region Sur http://www.symantec.com/region/mx
Cerrito 1054 - Piso 9 +54 (11) 4315-0889
1010 Buenos Aires Fax: +54 (11) 4314-3434
Argentina
Asia/Pacific Rim
Symantec Australia Pty. Ltd. http://www.symantec.com/region/reg_ap/
408 Victoria Road +61 (2) 9850 1000
Gladesville, NSW 2111 Fax: +61 (2) 9817 4550
Australia
Brazil
Symantec Brazil http://www.symantec.com/region/br/
Av. Juruce, 302 - cj 11 +55 (11) 531-7577
São Paulo - SP Fax: +55 (11) 5530 8869
04080 011
Brazil
Columbia, Venezuela, the Caribbean, and Latin America

Symantec América Latina http://www.symantec.com/region/mx/
2501 Colorado, Suite 300 +1 (541) 334-6050 (U.S.A.)
Santa Monica, CA 90404 Fax: (541) 984-8020 (U.S.A.)
55
Europe, Middle East, and Africa

Symantec Customer Service Center http://www.symantec.com/region/reg_eu/
P.O. Box 5689 +353 (1) 811 8032
Dublin 15 Fax: +353 (1) 811 8033
Ireland
Automated Fax Retrieval +31 (71) 408-3782
Mexico
Symantec Mexico http://www.symantec.com/region/mx
Periferico Sur No. 3642, Piso 14 +52 (5) 661-6120; +1 (800) 711-8443
Col. Jardines del Pedregal Fax: +52 (5) 661-8819
09100 Mexico, D.F.
Virus protection subscription policy

If your Symantec product includes virus protection, you might be entitled
to receive free virus protection updates via LiveUpdate. The length of the
free subscription could vary by Symantec product.
When you near the end of your virus protection subscription, you will be
prompted to subscribe when you start LiveUpdate. Simply follow the
instructions on the screen. After your free subscription ends, you must
renew your subscription before you can update your virus protection.
Renewal subscriptions are available for a nominal charge.
To order a subscription, do one of the following:

■ Visit our Web site at: http://www.shop.symantec.com.
■ Outside the United States, contact your local Symantec office or
representative.
Every effort has been made to ensure the accuracy of this information.
However, the information contained herein is subject to change without
notice. Symantec Corporation reserves the right for such change without
prior notice.
May 2000
56
Norton AntiVirus™
CD Replacement Form
CD REPLACEMENT: After your 60-Day Limited Warranty, if your CD becomes unusable, fill out and return 1) this form, 2) your
damaged CD, and 3) your payment (see pricing below, add sales tax if applicable), to the address below to receive replacement CD.
DURING THE 60-DAY LIMITED WARRANTY PERIOD, THIS SERVICE IS FREE. You must be a registered customer in order to receive CD
replacements.
FOR CD REPLACEMENT
Please send me: ___ CD Replacement
Name ________________________________________________________________________________________________________________
Company Name _______________________________________________________________________________________________________
Street Address (No P.O. Boxes, Please)_____________________________________________________________________________________
City ______________________________________________________________________ State _______ Zip/Postal Code _________________
Country* _________________________________________________________Daytime Phone _______________________________________
Software Purchase Date _________________________________________________________________________________________________
*This offer limited to U.S., Canada, and Mexico. Outside North America, contact your local Symantec office or distributer.
Briefly describe the problem:_____________________________________________________________________________________________
______________________________________________________________________________________________________________________
CD Replacement Price $ 10.00 SALES TAX TABLE: AZ (5%), CA (7.25%), CO (3%), CT (6%), DC (5.75%), FL (6%), GA (4%), IA (5%),
Sales Tax (See Table) ______ IL (6.25%), IN (5%), KS (4.9%), LA (4%), MA (5%), MD (5%), ME (6%), MI (6%), MN (6.5%), MO (4.225%),
NC (6%), NJ (6%), NY (4%), OH (5%), OK (4.5%), PA (6%), SC (5%), TN (6%), TX (6.25%), VA (4.5%), WA (6.5%),
Shipping & Handling $ 9.95 WI (5%). Please add local sales tax (as well as state sales tax) in AZ, CA, FL, GA, MO, NY, OH, OK, SC, TN, TX, WA,
TOTAL DUE ______ WI.
FORM OF PAYMENT ** (CHECK ONE):

___ Check (Payable to Symantec) Amount Enclosed $ _________ __ Visa __ Mastercard __ American Express
Credit Card Number ___________________________________________________________________________________Expires __________
Name on Card (please print) ________________________________________________ Signature ___________________________________
**U.S. Dollars. Payment must be made in U.S. dollars drawn on a U.S. bank.
MAIL YOUR CD REPLACEMENT ORDER TO:

Symantec Corporation
Attention: Order Processing
175 West Broadway
Eugene, OR 97401-3003 (800) 441-7234
Please allow 2-3 weeks for delivery within the U.S.
Symantec and Norton AntiVirus are trademarks of Symantec Corporation.
Other brands and products are trademarks of their respective holder/s.
 2000 Symantec Corporation. All rights reserved. Printed in the U.S.A.
58
✁
Potential Virus Submission Procedure
Note: Only use this form if you can’t use Scan and Deliver. Scan and Deliver sends quarantined virus samples
to the Symantec AntiVirus Research Center via the Internet. See “To submit a quarantined file to SARC” in
online help.
If you suspect your system has been infected by an unknown virus, complete the requested information on this
form. Then follow the procedure on the back of the form to create a “virus sample” floppy disk. Send the form
and the floppy disk to Symantec at the address below. The Symantec AntiVirus Research Center will analyze
your disk and inform you of the results. This is a free service provided to Norton AntiVirus customers as part of
Symantec’s commitment to virus-free computing.
Symantec AntiVirus Research Center
2500 Broadway, Suite 200
Santa Monica, CA 90404
Do not write “Contains Live Virus” on the envelope or disk mailer (this upsets the post office). All disks become
property of Symantec and will be destroyed.
Please provide the following information:
Operating System:
DOS (ver. _______ ) Windows 95/98 Windows NT/Windows 2000 Windows 3.x
Have you loaded the most recent virus definitions?

Yes (date of VIRSCAN.INF file ____________ ) No (date of VIRSCAN.INF file ____________ )
Has any other scanner identified a virus?

Yes (name and version of scanner ________________________ virus reported_______________ ) No
Describe the observed virus behavior with as much detail as possible (include infected
products, versions, and component information):
______________________________________________________________________________________________
______________________________________________________________________________________________
______________________________________________________________________________________________
______________________________________________________________________________________________
______________________________________________________________________________________________
______________________________________________________________________________________________
Your Name____________________________________________________________________________________
Company Name _______________________________________________________________________________
Street Address__________________________________________________________________________________
City _______________________________________________State _______ Zip/Postal Code _________________
Country__________________________________ Daytime Phone _______________________________________
Fax ___________________________ Email Address __________________________________________________
Creating a Virus Sample Floppy Disk
If Norton AntiVirus reports that a file is infected with an unknown virus, or if you suspect that a program or
document is infected, you can send it to the Symantec AntiVirus Research Center (SARC) for analysis.
Note: You can Quarantine a suspicious file and send it to SARC via the Internet for analysis using Scan and
Deliver. For more information, see “To submit a quarantined file to SARC” in online help.
Have you updated your virus definitions file to the most recent version? See “Keeping virus protection
current” in this guide for directions to receive the most recent virus definitions file. Then scan again. If you
still think you have an unknown virus infection, use the following procedure to create a “virus sample”
floppy disk. The Symantec AntiVirus Research Center (SARC) will examine the disk and contact you with
the results. This is a free service provided to Norton AntiVirus users.
To create a virus sample floppy disk:
1 Start the potentially infected system from its own hard drive.
Windows 95/98: Press function key F8 before Windows starts and choose “Safe mode
command prompt only” from the on-screen menu.
2 Format a floppy disk with the potentially infected operating system.
From the DOS prompt, type FORMAT A: /S and press Enter.
3 Do one of the following:
Windows 3.1/DOS: Copy MODE.COM, MEM.EXE, KEYB.COM, and XCOPY.EXE
■
from your C:\DOS folder to the floppy disk.

■ Windows 95/98: Copy MODE.COM, MEM.EXE, KEYB.COM, and XCOPY.EXE
from your C:\WINDOWS\COMMAND folder to the floppy disk.

■ Windows NT: Copy COMMAND.COM, CMD.EXE, MODE.COM, MEM.EXE, and
MORE.EXE from \Winnt\system32 to the floppy disk.

4 Type A: and press Enter to change to the A: drive.
5 Type PATH; and press Enter (don’t forget the semicolon) to remove the path from
the environment temporarily.
6 Run the programs (ignore any screen messages). The engineers will be able to
determine if they become infected. For example,
■ Type A:MODE and press Enter.
■ Type A:MEM and press Enter.
■ Type A:XCOPY and press Enter.
7 Program viruses: Copy any files that you suspect are infected to the floppy disk in
the A: drive.
Word macro viruses: Copy any documents that you suspect are infected, along with
NORMAL.DOT from the TEMPLATE directory, to the floppy disk in the A: drive.
Excel macro viruses: Copy any worksheets that you suspect are infected, along with
any files in the XLSTART directory, to the floppy disk in the A: drive.
8 Label the floppy disk with your name, address, telephone number, and the date of
its creation. Write “Potential Virus” on the disk label.
9 Complete and send the form on the previous page with the floppy disk to Symantec.
I N D E X
A D
ActiveX controls 14 deleting infected files 40, 42-43
alert actions 39 disabling Auto-Protect 35
alerts downloads, scanning automatically 33
actions to take 39 drives, scanning 36
Norton AntiVirus 27-29
virus found 27-29, 40
virus-like activity 41 E
AOL 19 email protection 13, 14, 32
applications Emergency Disks 9
avoiding infected 34 emergency procedures 9
backup copies 34 enabling virus protection 33, 34-35, 36, 50
disabling virus protection when excluding files from scans 40
installing 35
virus-like activity 41
attachments, email 14, 32 F
Automatic LiveUpdate 11, 13 file extensions
Auto-Protect infected files 42
enabling 36, 50 scans missing unusual 50
failure to load on startup 49-50 files
icon 33, 35 reinfected after virus removal 50
maintaining protection 34-35 scanning all 50
avoiding viruses 31 floppy disks, scanning 36
floppy drives, unable to boot from 49
B
backup copies H
infected 40, 43 help 11, 24-26
replacing infected files 43
software 34
boot records, unable to repair 43
I
booting icon, Auto-Protect 33, 35
absent 48 infected files
Auto-Protect failure to load 49-50 deleting 40
changing floppy drive settings 49 excluding from scans 40
floppy drive fails 49 file extensions 42
Rescue Disk fails 47 ignoring 40
quarantining 39
reinfected 50
C repairing 39
compressed files 14, 33 unable to repair 42-43, 50
Search the online help index for more information. 61

installing P
Norton AntiVirus 7-11
password 51
programs, disabling Auto-Protect 35
preventing viruses 31
Internet, virus protection 33
programs
Iomega Jaz drive 20
avoiding infected 34
Iomega Zip drive 19
backup copies 34
irreparable system files 43
disabling virus protection when
installing 35
J virus-like activity 41
protection. See virus protection
Java applets 14
L Q
Quarantine 14, 39, 45
LiveUpdate 11, 15, 18
automatic 11, 13
R
M removing
infected files 42-43
malicious code 14
viruses during installation 9
master boot record 43
viruses from memory 41
memory, removing viruses from 41
repairing
infected files 39
N unsuccessful 42-43, 50
Norton AntiVirus requirements, system 7
alerts 27-29 Rescue Disk 15
basics 17-26 Rescue Disks
emergency procedures 39-46 absent 48
features 14-15, 32 creating 19-22
installing 7-11 failure to start from 47
procedures 31-36 importance 12
updating 23
when to update 33
O
online help 11, 24-26
operating systems, multiple 48
S
options, setting 18 safe mode 49
SARC 45
Scan and Deliver 45
scanning
all files 50
compressed files 33
drives 36
email 14, 32
floppy disks 36
Service and Support 53
62 Search the online help index for more information.

setup program, changing boot drive virus protection (continued)
sequence 49 user responsibilities 33
setup, Norton AntiVirus 7-11 virus protection 33
Smart Scanning Technology 13 viruses
SmartScan 13 alerts 27-29
software avoiding 31, 33-34
avoiding infected 34 behavior 31
backup copies 34 new 33
disabling virus protection when protection from 14
installing 35 removing during installation 9
virus-like activity 41 understanding 31
startup virus-like activity alerts 41
Auto-Protect failure to load 49-50
changing floppy drive settings 49
floppy drive fails 49 W
Rescue Disk fails 47 What’s This? help 25
Rescue Disks absent 48 Windows safe mode 49
subscription, virus protection 18 worm 32
system files, unable to repair 43, 50
system requirements 7
Z
Zip Rescue Disk
T creating 19-22
Technical Support 53 updating 23
Trojan Horses 14, 32
troubleshooting 47-51
U
uninstalling 12
updating virus protection 11, 15, 18, 33
V
virus
removal tools 42
submitting to SARC 45
virus alerts. See alerts
virus protection
compressed files 33
downloads 33
email 32
enabling 33, 50
maintaining 11
Norton AntiVirus features 32
subscription 18
updating 15, 33
Search the online help index for more information. 63

Nav

Uploaded by

Copyright:

Available Formats

Nav

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Nav

Uploaded by

Copyright:

Available Formats

Norton AntiVirus™

NOTICE: SYMANTEC LICENSES THE ENCLOSED SOFTWARE LIMITED WARRANTY:

See “Scanning for

See “What to do if a virus

Chapter 1 Installing Norton AntiVirus

Chapter 2 Introducing Norton AntiVirus

Chapter 3 Norton AntiVirus basics

Chapter 4 Responding to Norton AntiVirus alerts

Chapter 6 Norton AntiVirus emergency procedures

Potential Virus Submission Procedure

Installing Norton AntiVirus

Note: You do not need to uninstall previous versions of Norton AntiVirus

Windows 95 OSR2 and Windows 98

Windows NT 4.0 Workstation

Windows 2000 Professional

While not required, an Iomega Zip drive is a definite advantage when

■ Becky! Internet Mail 1.26

Warning: Perform the following procedure on a different computer from

To make Emergency Disks:

To use the Emergency Disks:

3 Follow the on-screen instructions.

Using the CD as an Emergency Disk

To use the CD as an Emergency Disk:

If the opening screen does not appear:

While this user’s guide contains helpful information, there is additional

Keeping your system protected

Norton AntiVirus relies on up-to-date information to detect and eliminate

Uninstalling Norton AntiVirus

To remove Norton AntiVirus from your computer:

What’s new in Norton AntiVirus 2001?

SmartScan improves file scanning performance and reduces system impact

SmartScan represents a significant security enhancement for users who

Comprehensive email scanning protection provides added support for

Protection from harmful code

Detection of viruses in compressed files

Updating with LiveUpdate

Norton AntiVirus basics

Navigating Norton AntiVirus

2 From here you can do the following:

Updating Norton AntiVirus with LiveUpdate

Note: Your normal Internet access fees apply.

To update Norton AntiVirus using LiveUpdate:

Tip: If you connect to the Internet through AOL, CompuServe, or Prodigy

Creating Rescue Disks

Caution: Never use Rescue Disks made on another computer. Rescue

Creating Norton Zip Rescue Disks

To create a Norton Zip Rescue Disk set:

Caution: If you have multiple Zip drives installed on one computer,

Creating basic Rescue Disks

To create basic Rescue Disks:

Caution: If you select a network drive, a second physical hard disk, or

4 Insert a floppy disk into your A: drive.

Updating Rescue Disks

To update your Rescue Disks:

Caution: If you have multiple Zip drives installed on one computer,

5 Click Restart to test the newly updated Rescue Disks.

Using help to learn more about Norton AntiVirus

Norton AntiVirus includes three kinds of help:

Help with program dialog boxes